By Marc Alexander

France's regulator was the first in Europe to fine the big platforms over cookie banners, and it did so for a reason every website can be caught by: making it harder to say no than to say yes. Here's what the CNIL expects, where GA4 fits, and what to check on a French site.

The rules.

France's cookie rules come from Article 82 of its Data Protection Act, which implements the EU's ePrivacy rules, read together with the GDPR. The regulator is the CNIL. Its guidelines and recommendation of September 2020 set out what a banner has to do:

  • Consent before non-essential cookies. Nothing that isn't needed to provide the service the visitor asked for may be set first.
  • Rejecting as easy as accepting. If there's an "Accept all" button, there has to be a way to refuse that takes the same effort. A "Continue without accepting" link in the corner is the common French answer.
  • Browsing isn't consent. Scrolling, closing the banner or carrying on doesn't count.
  • Purposes listed, and separately choosable.
  • Withdrawal as easy as giving. A visitor who said yes must be able to change their mind from any page.

In January 2022 the CNIL fined Google and Facebook for banners that took one click to accept and several to refuse. Smaller sites have had the same letter since. The point stuck: the reject button is the test.

Where GA4 stands.

French law exempts some audience measurement from consent, and the CNIL used to publish a list of tools that qualified when set up its way.

In July 2025 it replaced the list with a self-assessment: a tool is exempt only if it measures the publisher's own site, produces aggregated statistics, doesn't follow people across sites, and shares nothing with a third party for its own use.

A standard GA4 setup sends data to Google and can be linked to Google Ads, so it doesn't fit. GA4 on a French site needs consent, first-party cookie or not.

Two more things follow for Google's tools:

  • Consent Mode v2. France is in the EEA, so Google needs the Consent Mode v2 signals to keep remarketing and audiences working for French visitors. Use basic: Advanced Consent Mode v2 isn't GDPR compliant. Basic or advanced explains why.
  • Transfers. The CNIL's 2022 notices over Google Analytics were about data leaving the EU without adequate protection. The EU-US Data Privacy Framework has covered that since 2023, as explained in GA4 and EU data transfers, and it's still worth saying so in the privacy notice.

Where French sites usually go wrong.

  1. A banner that appears but changes nothing: GA4 and the ad pixels fire on page load before anyone chooses.
  2. "Continue without accepting" present, but tags fire anyway because the consent manager and Tag Manager were never connected.
  3. A banner translated from an English template, with "Accept" in a big button and "Settings" in small text.
  4. Consent Mode missing, or set to granted by default so the reports look fuller.
  5. No way to change the choice later.

What to check.

  1. Open the site in a private window and, before touching the banner, watch the network requests. Nothing but essential requests should go out.
  2. Click "Continue without accepting", reload, and check again.
  3. Accept analytics only, and check that advertising tags still wait.
  4. Test Consent Mode with the Consent Mode v2 testing guide.

The wider EU picture is in GA4 and EU consent rules. Marc Alexander sets up GA4, Tag Manager and Consent Mode for French and other European businesses, with prices in euros. The free tracking checker shows what a French page loads before anyone chooses.